Defensive Resource
Mobile Spyware Incident Response Checklist
Fourteen steps, in order, for suspected mobile spyware. Print it, or use the browser's print-to-PDF to keep an offline copy. No email address is required to read it.
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
- 01
Device isolation
Remove corporate connectivity and stop using the device for authentication. Consider airplane mode if collection is suspected to be active.
- 02
Evidence preservation
For high-value cases, preserve before altering. Record device state, installed apps, profiles and permission grants.
- 03
Identity review
Pull sign-in, MFA and token-issuance telemetry for the suspected exposure window.
- 04
Credential reset from trusted endpoint
Reset from a separate known-clean device, starting with email and the identity provider.
- 05
MFA assessment
Audit enrolled methods, remove unknown enrolments, migrate away from SMS.
- 06
Email session review
Revoke sessions, inspect forwarding rules, delegates and inbox rules.
- 07
Cloud session review
Revoke refresh tokens, review OAuth grants and admin-console activity.
- 08
Banking review
Notify institutions, enable alerts, review recent transactions and payee changes.
- 09
Crypto review
Treat recovery phrases as exposed, move funds from a clean device, revoke approvals and API keys.
- 10
Mobile forensic escalation
Engage specialist support for executives, officials, journalists and legal-sensitive cases.
- 11
MDM review
Verify compliance state, enrolment, configuration profiles and installed managed apps.
- 12
MTD review
Check app reputation findings, risky configuration alerts and network-attack detections.
- 13
Network review
Hunt rare-domain resolution and regular beaconing predating the report.
- 14
Post-incident monitoring
Monitor identity and network telemetry for a defined period after recovery.
Scope
Support This Publisher
Related Intelligence
Intelligence Brief
ZeroDayRAT Intelligence Brief
Receive significant ZeroDayRAT and mobile-spyware research updates, defensive guidance and new technical analysis. No countdown timers, no sales pressure.